@almadar/integrations 2.25.0 → 2.27.0

package/dist/{store-CW1v7Apc.d.ts → store-tehIm2rt.d.ts}

@@ -1,5 +1,5 @@
 import { ServiceParamsValue, ServiceParams, EntityRow } from '@almadar/core';
-import { d as IntegrationParamValue, e as IntegrationParams } from './BaseIntegration-MA-b4fh8.js';
+import { f as IntegrationParamValue, g as IntegrationParams } from './BaseIntegration-C_5q54DM.js';
 
 /** Scalar value admissible as a SQL bind parameter. */
 type DatabaseQueryParamValue = string | number | boolean | Date | null;
@@ -323,6 +323,7 @@ type TwilioActions = {
         params: {
             to: string;
             body: string;
+            from?: string;
         };
         result: {
             sid: string;
@@ -347,6 +348,11 @@ type EmailActions = {
             subject: string;
             body: string;
             from?: string;
+            /** HTML content; when present `body` becomes the plain-text alternative. */
+            htmlBody?: string;
+            replyTo?: string;
+            /** Provider template reference (SendGrid dynamic templates; Resend rejects it loudly). */
+            templateId?: string;
         };
         result: {
             id: string;
@@ -857,6 +863,7 @@ type StorageActions = {
             bucket: string;
             prefix?: string;
             maxKeys?: number;
+            continuationToken?: string;
         };
         result: {
             keys: Array<{
@@ -865,6 +872,7 @@ type StorageActions = {
                 lastModified: number;
             }>;
             truncated: boolean;
+            nextToken?: string;
         };
     };
     delete: {
@@ -1154,6 +1162,14 @@ type CredentialsActions = {
             message: string;
         };
     };
+    rotate: {
+        params: Record<string, never>;
+        result: {
+            rotated: number;
+            alreadyCurrent: number;
+            unreadable: number;
+        };
+    };
 };
 type OtelActions = {
     startSpan: {
@@ -1414,6 +1430,34 @@ type IntegrationName = keyof IntegrationContracts;
  * ```
  */
 type IntegrationActionName<K extends IntegrationName> = keyof IntegrationContracts[K] & string;
+/**
+ * Declared side-effect-free "Test connection" probes, executed by the
+ * `credentials.test` action through the normal factory path. Only services
+ * with a genuinely cheap, read-only, env-defaulted action carry one; the
+ * rest report credential presence + constructor validation.
+ */
+/**
+ * One inbound-hook mount a service's provider needs in a deployed app:
+ * `POST /api/hooks/:provider` verified by the provider's own token/signature,
+ * dispatching `event` onto the app bus. A hook is a PROVIDER property — the
+ * service invocation is the `.lolo` surface; codegen derives the mount from
+ * the app's invoked services × these declarations (I-26).
+ */
+interface HookDeclaration {
+    /** Provider key mounted at POST /api/hooks/:provider */
+    provider: string;
+    /** Bus event dispatched into the app on a verified callback */
+    event: string;
+    /** Env var carrying the provider's verification secret/channel token */
+    credentialEnv: string;
+    /** Factory export in @almadar/integrations: (secret?) => HookProvider */
+    providerExport: string;
+}
+/**
+ * Inbound-hook declarations per service — the single source the registry,
+ * codegen, and the playground mount derive from.
+ */
+declare const serviceHooks: Record<string, HookDeclaration[]>;
 
 /** Entity type the credential rows persist under (never a `.lolo`-declared entity). */
 declare const CREDENTIAL_ENTITY_TYPE = "AlmadarIntegrationCredential";
@@ -1457,17 +1501,26 @@ interface CredentialEntry {
 declare class CredentialStore {
     private readonly adapter;
     private readonly masterKeyHex;
+    private readonly previousKeyHex;
     private readonly byEnvVar;
     private readonly listeners;
     private warmed;
-    constructor(adapter: CredentialPersistence, masterKey?: string);
+    constructor(adapter: CredentialPersistence, masterKey?: string, previousMasterKey?: string);
     /** True when a valid master key is present (writes and decryption enabled). */
     get enabled(): boolean;
     /** Subscribe to credential changes; returns an unsubscribe function. */
     subscribe(listener: () => void): () => void;
     private notify;
     private encrypt;
-    private decrypt;
+    private decryptWithKey;
+    /**
+     * Decrypt one row, selecting the key by the row's stamped `keyId` (I-28):
+     * current key first, then the rotation-window previous key. Legacy rows
+     * (no `keyId`) try current then previous. Returns null when no held key
+     * decrypts the row — the row is unreadable, never silently wrong (GCM
+     * auth tags make a wrong-key success impossible).
+     */
+    private decryptRow;
     /**
      * Load and decrypt every stored row into memory. Returns the number of
      * resolvable credentials. Without a master key nothing decrypts (rows are
@@ -1482,8 +1535,19 @@ declare class CredentialStore {
     entries(): CredentialEntry[];
     /** Upsert one credential (encrypts, persists, re-warms the entry, notifies). */
     set(service: string, envVar: string, value: string): Promise<CredentialEntry>;
+    /**
+     * Re-encrypt every readable row under the CURRENT master key (I-28).
+     * Rotation window: deploy the new key as `ALMADAR_CREDENTIAL_MASTER_KEY`
+     * with the old one as `..._PREVIOUS`, call `rotate()`, then retire the
+     * previous key. Rows no held key can read are counted, never dropped.
+     */
+    rotate(): Promise<{
+        rotated: number;
+        alreadyCurrent: number;
+        unreadable: number;
+    }>;
     /** Delete one credential row; resolution falls back to env afterwards. */
     remove(envVar: string): Promise<boolean>;
 }
 
-export { type ArxivActions as A, type CLIActions as C, type DatabaseActions as D, type EmailActions as E, type GitHubActions as G, type IconifyActions as I, type LLMIntegrationActions as L, type MLActions as M, type OAuthActions as O, type QueueActions as Q, type RedisActions as R, type StorageActions as S, type TwilioActions as T, type WebhookActions as W, type YouTubeActions as Y, CREDENTIAL_ENTITY_TYPE as a, CREDENTIAL_MASTER_KEY_ENV as b, type CredentialEntry as c, type CredentialPersistence as d, CredentialStore as e, type DatabaseDriver as f, type DatabaseQueryParamValue as g, type DatabaseQueryParams as h, type DatabaseQueryResult as i, type DatabaseRow as j, type DeepAgentActions as k, type DockerActions as l, type IntegrationActionName as m, type IntegrationContracts as n, type IntegrationName as o, type OtelActions as p, type StripeActions as q, type WikimediaActions as r };
+export { type ArxivActions as A, type CLIActions as C, type DatabaseActions as D, type EmailActions as E, type GitHubActions as G, type HookDeclaration as H, type IconifyActions as I, type LLMIntegrationActions as L, type MLActions as M, type OAuthActions as O, type QueueActions as Q, type RedisActions as R, type StorageActions as S, type TwilioActions as T, type WebhookActions as W, type YouTubeActions as Y, CREDENTIAL_ENTITY_TYPE as a, CREDENTIAL_MASTER_KEY_ENV as b, type CredentialEntry as c, type CredentialPersistence as d, CredentialStore as e, type DatabaseDriver as f, type DatabaseQueryParamValue as g, type DatabaseQueryParams as h, type DatabaseQueryResult as i, type DatabaseRow as j, type DeepAgentActions as k, type DockerActions as l, type IntegrationActionName as m, type IntegrationContracts as n, type IntegrationName as o, type OtelActions as p, type StripeActions as q, type WikimediaActions as r, serviceHooks as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/integrations",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "External service integrations for Almadar applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.66.0",
+    "@almadar/core": "^10.68.0",
     "@almadar/llm": "^2.41.0",
     "@almadar/logger": "^1.11.0",
     "@aws-sdk/client-s3": "^3.700.0",

package/dist/factory-BPVhvv5q.d.ts

@@ -1,59 +0,0 @@
-import { I as IntegrationConfig, B as BaseIntegration, e as IntegrationParams, f as IntegrationResult } from './BaseIntegration-MA-b4fh8.js';
-
-/**
- * Optional per-call context for principal-scoped resolution (W4). The
- * default — absent — means the tenant/app-wide credential set; a `principal`
- * selects a per-principal configuration when one was registered. Additive:
- * every existing call site is untouched.
- */
-interface IntegrationCallContext {
-    principal?: string;
-}
-/**
- * Factory for creating and managing integration instances
- */
-declare class IntegrationFactory {
-    private instances;
-    private configs;
-    /**
-     * Configure an integration (doesn't instantiate yet). A `principal` scopes
-     * the config to that principal; the app-wide config (no principal) is the
-     * fallback for every principal.
-     */
-    configure(name: string, config: Omit<IntegrationConfig, 'name'>, principal?: string): void;
-    /**
-     * Get or create an integration instance. Principal-scoped lookups fall
-     * back to the app-wide config when no per-principal config exists.
-     */
-    get(name: string, principal?: string): BaseIntegration;
-    /**
-     * Execute an action on an integration
-     */
-    execute(integration: string, action: string, params: IntegrationParams, context?: IntegrationCallContext): Promise<IntegrationResult>;
-    /**
-     * Check if integration is configured
-     */
-    isConfigured(name: string, principal?: string): boolean;
-    /**
-     * Register an integration instance directly (used by mock infrastructure)
-     */
-    registerInstance(name: string, instance: BaseIntegration, principal?: string): void;
-    /**
-     * Drop the cached instance(s) for a name so the next `get` rebuilds from
-     * the current config — how a credential change goes live without restart.
-     * Configs are kept; without a name, every instance is dropped.
-     */
-    invalidate(name?: string): void;
-    /**
-     * Clear all instances (useful for testing)
-     */
-    clear(): void;
-    /**
-     * Clear all instances and configs
-     */
-    reset(): void;
-}
-declare function getIntegrationFactory(): IntegrationFactory;
-declare function resetIntegrationFactory(): void;
-
-export { type IntegrationCallContext as I, IntegrationFactory as a, getIntegrationFactory as g, resetIntegrationFactory as r };